Encryption transforms readable data into ciphertext using a cryptographic algorithm and a key. Its main purpose is confidentiality: someone who obtains the encrypted data should not be able to read it without the appropriate key. Encryption does not, by itself, prevent deletion, service outages, compromised devices or misuse by an authorised user.
Symmetric and asymmetric encryption
Symmetric encryption uses a shared secret key. AES is a common example. The key must be generated, stored and distributed securely. Authenticated encryption modes can also detect unauthorised changes; confidentiality alone does not establish who sent a message.
Public-key cryptography uses a pair of related keys: a public key and a private key. Depending on the scheme, these support encryption, digital signatures or key agreement. A digital signature is not simply “encrypting with the private key”. Real systems often combine public-key techniques with symmetric encryption.
Hashing is not encryption
A cryptographic hash maps an input to a digest. It is designed to be one-way: there is no decryption key that recovers the input. Hashes are useful for integrity checks and as components of other cryptographic constructions. A bare hash does not establish the identity of the sender, and predictable inputs can still be guessed.
Directly storing SHA-256 or SHA-512 hashes is not an appropriate password-storage design: these functions are fast, making large numbers of guesses easier. Use a dedicated password-hashing scheme with a unique salt and an appropriate work factor, such as Argon2id, or an appropriate alternative such as scrypt or PBKDF2 for the deployment’s requirements. SHA-256 itself is not “broken”; it can be a component of a suitable construction such as PBKDF2-HMAC-SHA-256.
Where encryption helps
HTTPS protects data in transit between a browser and the service it connects to. Disk encryption helps protect a lost device while its data is locked. End-to-end encryption has a different trust model, in which the intended endpoints hold the decryption capability. These protections depend on implementation, key management and device security; an HTTPS padlock does not prove that a website is honest.
Use maintained libraries and standard protocols rather than designing your own cryptography. Combine encryption with access control, backups, updates and monitoring.
References: OWASP’s Password Storage and Cryptographic Storage guidance. Technical review: 30 October 2026.
